HTTP is poor people's HTTPS